Amygdala Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:38 AM UTC
• Version: 1.7.0

Overview

This skill is mostly aligned with its emotional-memory purpose, but it persistently processes conversation history and injects derived state into future sessions with insufficient safeguards.

Install only if you are comfortable with a skill that can read recent OpenClaw conversation transcripts, persist emotional inferences and excerpts under the workspace, auto-load generated emotional state into future sessions, and optionally run scheduled processing. Avoid --with-cron unless you want recurring background agent turns, review generated AMYGDALA_STATE.md and brain-dashboard.html, and treat the dashboard as unsafe for untrusted stored content until escaping is fixed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: scripts/sync-state.sh:86

Finding

Conversation-Derived Content Can Poison Persistent Agent Context

Content

View full analysis

### 3. Analyze Each Signal For each signal, assess: - **What emotion is present?** (joy, sadness, anger, fear, frustration, curiosity, connection, loneliness, relief, excitement, contentment, anxiety) - **Intensity?** (0.0-1.0) - **Who is feeling it?** (user, assistant, or both) - **What triggered it?** **Look for:** ...[truncated 3845 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: install.sh:53

Finding

Installer Registers Durable Scheduled Agent Turns

Content

View full analysis

/dev/null; then echo "⚠️ 'openclaw' not in PATH. Add these cron jobs manually:" echo "" echo "# Emotional decay (every 6 hours)" echo "openclaw cron add --name amygdala-decay --cron '0 */6 * * *' --session isolated --agent-turn '🎭 Run emotional decay: Run $SKILL_DIR/scripts/decay-emotion.sh and sync state'" echo "" echo "# Emotional encoding (every 3 hours)" echo "openclaw cron add --name amygdala-encoding --cron '30 0,3,6,9,12,15,18,21 * * *' --session isolated --agent-turn 'Run amygdala emotional encoding. Preprocess signals, detect emotions, update state.'" else echo " Creating amygdala-decay..." openclaw cron add --name amygdala-decay \ --cron '0 */6 * * *' \ --session isolated \ --agent-turn "🎭 Run emotional decay: Run $SKILL_DIR/scripts/decay-emotion.sh and report results" 2>/dev/null && echo " ✅ Created" || echo " ⏭️ Already exists" echo " Creating amygdala-encoding..." openclaw cron add --name amygdala-encoding \ --cron '30 0,3,6,9,12,15,18,21 * * *' \ --session isolated \ --agent-turn "Run amygdala emotional encoding: 1) Run preprocess-emotions.sh 2) Read encode-emotions.md 3) Update state for significant emotions 4) Update watermark 5) Sync state" 2>/dev/null && echo " ✅ Created" || echo " ⏭️ Already exists" fi fi ``` ### Technical Analysis When installation is invoked with the documented `--with-cron` option, it creates two recurring OpenClaw jobs. These are not narrowly scoped operating-system commands; they are recurring agent turns capable of interpreting instructions, reading transcripts, invoking scrip ...[truncated 1400 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate-dashboard.sh:593

Finding

Stored HTML and JavaScript Injection in Generated Dashboard

Content

View full analysis

$AGENT_NAME

Brain Dashboard

$MOOD_EMOJI $MOOD_LABEL

``` ```javascript // scripts/generate-dashboard.sh:593-599 const state = { hippocampus: ...[truncated 4101 chars]

Remediation

View remediation

` element or load it from a separate local JSON file. 5. When embedding JSON in HTML, escape `<`, `>`, `&`, U+2028, and U+2029, including script-closing sequences. 6. Validate numeric dimensions as finite numbers before placing them in JavaScript or CSS. 7. Apply an allowlist to avatar MIME types and verify file content rather than relying only on the filename extension. 8. Add a restrictive Content Security Policy that blocks inline scripts and limits outbound connections. 9. Add regression tests using payloads containing HTML tags, event handlers, template-literal delimiters, and script-closing sequences. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/preprocess-emotions.sh:42

Finding

Shell Values Are Interpolated Directly into Inline Python Source

Content

View full analysis

/dev/null || echo "(none)") python3 -c " ``` ### Technical Analysis The scripts build Python programs by embedding shell variable values directly into quoted Python source. Shell quoting and Python string-literal quoting are separate parsing layers. A value containing a single quote, backslash, newline, or crafted Python expression can terminate the intended Python literal and inject additional source code. Potentially relevant inputs include: - `WORKSPACE`, which determines state and output paths. - `SESSION_FILE`, derived from a filesystem path. - `WATERMARK`, read from mutable JSON state. - The `--output` value accepted by `sync-state.sh`. The values are not passed as data through `sys.argv` or environment variables. Exploitation requires the attacker to control one of these paths or stored values, so this is primarily a local or compromised-workspace attack boundary. ### Attack Path 1. An attacker controls the execution environment, a workspace path, a selected session filename, the stored watermark, or the `sync-state.sh --output` argument. 2. The controlled value includes characters that terminate the surrounding Python string literal. 3. The s ...[truncated 728 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose centers on emotional processing, but the documented behavior also includes generating a dashboard, reading IDENTITY.md and avatar data, and aggregating data from other brain skills. This mismatch can mislead users about the real data access and output surface, causing them to approve a skill that touches more files and systems than the description suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes automatic processing of conversations and recurring cron-based emotional encoding, but it does not clearly warn users that potentially sensitive transcript content may be read, analyzed, and persisted over time. In an agent skill context, silent or underexplained processing of conversation history creates a real privacy and consent risk, especially because users may not realize the scope, frequency, or retention implications of the automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation instructions state that setup will generate session-injected state and install recurring cron jobs, but they do not present this behavior as a prominent warning requiring informed consent. Auto-injecting generated content into future sessions changes agent behavior persistently, and scheduled background tasks can continue operating after install, which makes this a meaningful transparency and user-control issue.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The README explicitly describes creation of persistent emotional state and automatic injection of generated state into future sessions. While persistence is core to the skill's purpose, it still expands the attack and privacy surface because prior interactions can influence later sessions in opaque ways, and sensitive derived state may persist longer than users expect.

Content

Scanner excerpt · README.md (reported line 198)May include surrounding context.

text

The install script will:
- Create `emotional-state.json` with baseline values
- Generate `AMYGDALA_STATE.md` (auto-injected into sessions!)
- Set up cron for decay every 6 hours

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents shell execution, file reads/writes, environment access, and cron-based persistence, but it does not declare an explicit tool scope or permissions boundary. This increases the chance that an agent or user enables broader capabilities than expected, making hidden side effects like persistent state changes, transcript processing, and file generation less visible and less governable.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill intentionally creates persistent emotional state and schedules recurring updates via cron, causing state to survive across sessions and influence future behavior. In this context the persistence is part of the product goal, but it still creates a real security and privacy risk because stored state and automated background processing can accumulate sensitive inferences and affect future agent responses in ways users may not expect.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

text

This will:
- Create `memory/emotional-state.json` with baseline values
- Generate `AMYGDALA_STATE.md` (auto-injected into sessions!)
- Set up cron for automatic decay every 6 hours

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes automatic analysis of conversation history, including extracting new signals and using an LLM/sub-agent for semantic emotional detection, without a clear privacy warning or consent model. That creates a meaningful risk of processing sensitive user conversations and persisting inferred emotional metadata without users understanding the collection, analysis, or retention involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that AMYGDALA_STATE.md is auto-generated and automatically injected into future sessions, but it does not prominently warn that persisted emotional summaries will become part of later prompts. This can leak sensitive inferences, bias future model behavior, and unintentionally expose prior conversation-derived content across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt instructs the agent to execute local shell scripts that process conversation history and then update persistent memory files, but it provides no user-facing consent, transparency, or gating around that data access and state mutation. In an agent setting, this can cause silent collection of sensitive conversation content and persistent behavioral changes without the user's knowledge, which is especially risky because this skill is explicitly designed to influence future responses via emotional state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This shell script performs in-place writes to the emotional state file and later prunes historical entries from the recentEmotions list. Although it prints progress messages, there is no user-facing warning that running the script will overwrite persisted state and delete older data unless the user inspects the implementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes extracted emotional transcript content, including up to 500 characters of message text plus inferred emotional labels, into a persistent workspace file without any consent check, minimization beyond truncation, retention control, or warning to the operator. Because this skill is specifically designed to process sensitive affective signals, persistent storage increases privacy risk and can expose highly personal conversation content to other tools, users, or later compromise of the workspace.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes this skill as an emotional processing layer with persistent emotional states influencing behavior. This script, however, reads not only amygdala emotional-state data but also hippocampus memory data and VTA reward-state data, then builds a combined 'Brain Dashboard' spanning all three subsystems. That broad dashboarding behavior exceeds the manifest's emotion-focused scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes emotional state, memory summaries, rewards, and identity-derived data into a persistent HTML file in the workspace without consent, minimization, or access protections. In agent environments, those files can contain sensitive behavioral history, and converting them into an easily viewable dashboard increases unintended disclosure risk to local users, other tools, or anything serving/opening the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script directly reads and prints persistent emotional-state data, including recent feelings and triggers, with no access control, consent prompt, redaction, or privacy notice. In an agent-memory skill, this data is especially sensitive because it can reveal behavioral tendencies, internal state, and potentially user-correlated context to any caller that can invoke the script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persistently writes extracted conversation text, including all user messages and emotionally relevant assistant content, to a JSONL file under the workspace without any notice, consent, minimization, or access-control checks. Because this skill is specifically designed to infer emotional state, the stored data is unusually sensitive and could expose private thoughts, distress, relationship details, or other intimate context if the workspace is accessed by other tools, users, or later compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persistently writes the user-supplied emotional trigger and emotion data to a JSONL log file without any consent prompt, retention control, or access protection. In the context of an emotional memory skill, these triggers can contain highly sensitive psychological, interpersonal, or operational context, so silent persistence increases privacy and data-exposure risk if the workspace is shared, backed up, or later consumed by other agents/tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The event logging feature persists emotional activity to a long-lived analytics file without clearly warning about retention or downstream use. Even if the logged fields seem limited, repeated entries can reveal behavioral trends, sensitive emotional patterns, and timing data over extended periods.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code parses IDENTITY.md and local avatar image files, then base64-embeds the avatar into the generated dashboard. Personalization of agent identity and profile imagery is not an obvious requirement for an emotional processing layer whose declared purpose is persistent emotional state management. This adds a presentation/profile capability outside the stated amygdala function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The output document explicitly fixes the page language to English, which is a natural-language locale decision applied regardless of user preference. There is no indication that the skill offers locale selection or that the English-only behavior is justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.